How to Build an Effective Crisis Management Team: Seven Steps

An effective crisis management team is built, not appointed. Most organizations have a list of names on page four of the crisis plan. Far fewer have a team: people who know their seat, know who decides what, know when to show up, and have practiced together before the bad day.

The quality of the team, not the thickness of the binder, determines how your organization performs under pressure. As I said on Managing Uncertainty, Episode 297, crisis leadership “is not about having a perfect plan, but rather about perfecting the ability to lead through the unknown.”

Here is how to build a crisis management team that can do that, in seven steps.

Old View	New View
The team is a roster in the plan	The team is a group that meets, trains, and exercises together
Seats go to the most senior title	Seats go to the people who perform under pressure
One name per role	A primary and at least one backup for every seat
Everyone decides, so nobody decides	Decision rights are written down before the crisis
Activate when it’s obviously a crisis	Activate on defined severity levels, early

What a Crisis Management Team Does

A crisis management team (CMT) is the cross-functional group that manages the organization’s response when an incident outgrows the people who handle it every day. It assesses the situation, makes or escalates decisions, coordinates the functions involved, and communicates on a steady cadence to everyone who needs to know.

It is not the site team putting out the fire, and it is not your executives. The site team handles the scene. The CMT runs the enterprise response. Your executives make the handful of strategic calls that belong to them.

One more principle before the steps: a crisis is a crisis. Cyber, physical security, product, financial, misconduct. The way your team collaborates, decides, communicates, and escalates should not change with the incident type. Build one team and one process, then layer incident-specific checklists on top.

How to Build an Effective Crisis Management Team in Seven Steps

1. Start with the decisions, not the org chart

Before you pick a single name, write down what the team will decide. Then write down what it won’t.

We put decision rights in three tiers:

• The crisis management team decides and runs the response moment to moment.
• Your executives reserve a short list: major resource commitments, reputational campaigns, and external messaging approval.
• The board reserves what its governance says it owns. Before founding Bryghtpath, I worked at Target, where the board reserved CEO and senior executive succession and capital spending over a set threshold.

Teams that skip this step argue about authority in the middle of the crisis. When a global consumer and commercial technology manufacturer stress-tested its newly formed Crisis Management Team and Steering Committee with us, the tabletop showed real strengths and also surfaced opportunities in decision ownership and escalation governance. That is a normal finding for a new team. It is far better to find it in an exercise.

2. Fill seats by function, not by title

Your CMT needs every function that will own part of the response. A typical roster:

• Crisis leader (incident leader), plus a scribe or administrator
• Human Resources
• Legal
• Risk and Compliance
• Facilities and Physical Security
• Finance
• Information Technology and Information Security
• Corporate Communications
• The business lines and operations that keep revenue moving

Right-size it. A smaller organization can start with five people, a leader and a backup, and a first-call agenda. A very large enterprise may need 25 or more people across the team and its subteams.

The most common mistake we see is appointing people because of their title rather than their skill or their demeanor under pressure. Look for people with a broad view of their function, who know where to get information fast, who can be strategic and tactical in the same hour, and who will tell the room what it doesn’t want to hear. Write each seat’s responsibilities on a one-page role card.

3. Name a primary and a backup for every seat

Crises don’t wait for your primaries. They happen when the general counsel is on a plane and the head of HR is on vacation.

Every seat needs a named primary and at least one trained backup. The crisis leader seat needs more depth than that: several people authorized and trained to lead, rotated through primary, backup, and tertiary roles in exercises. Sometimes we run exercises with only the backups at the table while the primaries observe. That might be your reality on the day it counts.

4. Split the leadership role in two

At the end of the day, somebody has to be in charge. In most organizations, that works best as two roles, not one:

• The incident leader masters the process. They drive activation, chair the meetings, keep the agenda moving, and guide the team to consensus. It is a coordinating role more than a deciding one.
• The responsible executive (some clients say on-call executive) makes or confirms the decisions and is the conduit to the executive team.

The incident leader should usually not be a senior executive. Executives make strategic decisions, and some crises, misconduct among them, need a neutral leader outside the C-suite. I explained the model on Episode 156: Someone Has to Be in Charge. For what to look for in the person, see choosing the right crisis leader.

5. Tie activation to severity

Who shows up should depend on how bad it is. Define severity levels the whole organization uses, and attach an activation response to each one. A four-level model works for most clients:

• Level 4, routine event. Handled every day by the people who own it. A broken conveyor, a routine media call, a phishing email.
• Level 3, escalating incident. Contained to one area, but it requires mandatory notification so nobody learns about it from the news.
• Level 2, crisis. The organization can’t operate normally, though its survival isn’t at risk. The cross-functional team activates.
• Level 1, critical disruption. Novel or extreme impact that needs a sustained response, with your executives and possibly the board engaged.

It doesn’t matter what you call the levels. It matters that everyone uses the same definitions, and that IT’s “Severity 1” and the crisis team’s “Level 1” don’t point in opposite directions.

Then lean toward activating. Over-respond, but don’t overreact. Convening the team to assess something that turns out to be minor costs a few people an hour. Waiting too long costs far more. Our post on why it’s so hard to activate a crisis management process covers the barriers.

6. Build subteams for geography and operations

Large organizations rarely run every crisis from one room. A disruption in Tokyo differs from one in Chicago, culturally and logistically, and a single headquarters team can’t see both.

Centralize crisis governance, then delegate authority to regions and sites. Regional or country teams handle the local response under the same framework, severity levels, and communication cadence. Operational subteams (a technology recovery team, a customer operations team) work their part of the problem and report into the CMT. The structure only works if every subteam knows what it can decide on its own and what must come up.

7. Use the team between crises

A crisis management team is a team. A group that meets only during a crisis, or once a year for the exercise, never builds the trust it needs at 2 AM. If you don’t use the team, it will atrophy.

• Meet at least quarterly. Use a standing agenda: recent disruptions (including the near misses that never triggered activation), upcoming exercises, events in your industry, and a what-if discussion. Our post on consistent crisis management team agendas has the format.
• Train before you exercise. People need to know the process before you test it.
• Exercise on a cadence. Tabletops build confidence and cohesion. Simulations, where actions have consequences, produce the most growth.
• Close the loop. Every exercise and real activation ends with an After-Action Report (AAR) whose recommendations have owners and due dates.

For a global quick service restaurant chain with limited internal crisis staff, we run exactly this rhythm as a managed service: quarterly crisis management team meetings and training, quarterly incident leader meetings, four crisis exercises a year with after-action reports, and remediation of what those exercises find.

The crisis management team section of our Ultimate Guide to Crisis Management puts the team in the context of the full framework.

Common Mistakes When Building a Crisis Management Team

• Choosing members by title. Seniority is not the same as composure.
• No backups. A single point of failure in the seat that matters most.
• Executives running the response. When executives bypass or override the process, they undercut the team they need.
• An incident leader with no support. The leader needs a scribe, action tracking, and a communications partner.
• Scripted exercises. Theater builds confidence that won’t survive a real event.
• Staying siloed. A security-only or IT-only team will miss the people, legal, and reputational sides of the crisis.

Frequently Asked Questions

Who should be on a crisis management team?

A crisis leader and a scribe, plus representatives from HR, Legal, Risk and Compliance, Facilities and Security, Finance, IT and Information Security, Communications, and the business lines that keep revenue moving. Each seat needs a primary and a trained backup.

How big should a crisis management team be?

As small as the job allows. Many organizations start with five to ten people. Large global enterprises may reach 25 or more across the core team and its regional and operational subteams.

Should the CEO lead the crisis management team?

Usually not. Your executives should make the strategic decisions reserved to them while a trained incident leader runs the process. Pair that leader with a responsible executive who makes or confirms decisions and briefs the executive team.

How often should a crisis management team meet?

At least quarterly between crises, with a standing agenda, plus training and exercises during the year. Some organizations meet monthly.

Because in a crisis, you cannot improvise this process. Build the team before you need it.

Keep Going

A few ways to go deeper if this was useful.

• Read more. Resilience, crisis management, and continuity writing at Bryghtpath Insights, or the structured Ultimate Guide to Crisis Management.
• Build or rebuild your team. Our Crisis Management services stand up the framework, the team, its decision rights, and the exercise program.
• Get a maturity score. Our Resiliency Diagnosis® is a standards-based review that produces a maturity score and a prioritized roadmap.
• Talk to us. Set up a call to think through your crisis management team with us.